CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2016-4295 affects Hancom Office 2014 and can lead to a heap overflow when processing a Hangul Hcell Document (.cell). The issue arises from an index miscalculation while processing formula data used to render a chart.
CVE-2016-4294 affects Hancom Office 2014, which can lead to a heap-based buffer overflow when opening a Hangul Hcell document (.cell). The issue occurs while processing a property record within the Workbook stream, where the application uses an incorrect size to copy user-supplied data.
A vulnerability in Hancom Office 2014 allows for exploitation of a memory allocation error when processing a Hangul HShow document (.hpt). An attacker can trigger memory corruption outside the allocated buffer, potentially leading to code execution.
CVE-2016-4291 affects Hancom Office 2014, where opening a Hangul HShow document (.hpt) can lead to an integer overflow. This results in improperly allocated memory that can cause data to be written outside the allocated buffer.
A vulnerability in Hancom Office 2014 allows for memory data overwriting, potentially leading to code execution. The issue occurs when opening Hangul HShow documents (.hpt) and is related to incorrect buffer length calculations.
A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions that allows users to execute arbitrary programs with SYSTEM privileges.
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted data sent via the server could lead to a buffer overflow, potentially resulting in memory corruption.
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could lead to an out-of-bounds write.
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution.
A memory corruption vulnerability exists in Pidgin's handling of the MXIT protocol. A specially crafted MXIT MultiMX message sent via the server can lead to an out-of-bounds write, resulting in memory disclosure and code execution.
An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.
An attacker can spoof a packet from a legitimate ntpd server, leading to the client rejecting future responses from valid servers. Clients running NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject responses after the mode has been changed.
The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509 certificate.
MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in an X.509 certificate.
The Parental Control panel in Genexis devices with DRGOS before version 1.14.1 allows remote authenticated users to execute arbitrary CLI commands via the start_hour, start_minute, end_hour, end_minute, or hostname parameters.
The ring_buffer_resize function in the profiling subsystem in the Linux kernel before version 4.6.1 mishandles certain integer calculations, allowing local users to gain privileges by writing to the /sys/kernel/debug/tracing/buffer_size_kb file.
The _prolog_error function in slurmd/req.c in Slurm before version 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability that allows a user to take control of an arbitrary file on the system in the event of a Prolog script failure. Exploitation of this vulnerability depends on the user's ability to cause or anticipate the failure of the script.
Menadżer pamięci dzielonej w sshd w OpenSSH przed wersją 7.4 nie zapewnia, że sprawdzenie granic jest egzekwowane przez wszystkie kompilatory. Może to umożliwić lokalnym użytkownikom uzyskanie uprawnień poprzez wykorzystanie dostępu do procesu separacji uprawnień w piaskownicy, związane z strukturami danych m_zback i m_zlib.
W OpenSSH przed wersją 7.4, gdy separacja uprawnień nie jest używana, tworzone są przekazywane gniazda Unix jako root, co może umożliwić lokalnym użytkownikom uzyskanie uprawnień za pomocą nieokreślonych wektorów, związanych z plikiem serverloop.c.